This happens because VirtueMart is trying to check if your remote IP address matches the PayPal one. However, since your traffic is coming through our servers, they see Sucuri’s IP address instead of yours. Sucuri always provide the real IP address using multiple standard headers, but it seems like VirtuMart does not support it yet.

To fix this, just add the following code to the top of the notify.php file inside VirtueMart: